On both ARM and ARM64 we map DMA coherent memory the same as IO memory. This has the effect that unaligned accesses are not possible on DMA coherent memory. The dwc3 gadget driver uses memset() and memcpy() on that memory which may generate unaligned accesses and result in data aborts. Use memcpy_fromio() and memset_io() instead which are desgined to work on IO space and thus do not generate unaligned accesses. The alternative would be to map DMA coherent memory as MT_NORMAL_NC instead of MT_DEVICE_nGnRnE, but that require us to add memory barriers to drivers which we currently do not have. SO instead of risking regressions in drivers we take the easy way out and avoid unaligned accesses in the dwc3 driver. In this concrete case the dwc3 driver generated unaligned accesses on a Rockchip RK3568 ARM64 system. The driver copies data out of the receive queue. In my case first 4 bytes were copied, both source and target were aligned. The second access then copied more data beginning at the place where the first memcpy stopped. On this 4byte aligned address memcpy generated an 8byte read access which resulted in a data abort. On an ARM32 system this might not be a problem as that place, while not 8byte aligned, is still 4byte aligned, enough for a 32bit system. Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> --- drivers/usb/dwc3/gadget.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index f416acc999..49deaf4d98 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -643,14 +643,14 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action) /* Initialize the TRB ring */ dep->trb_dequeue = 0; dep->trb_enqueue = 0; - memset(dep->trb_pool, 0, + memset_io(dep->trb_pool, 0, sizeof(struct dwc3_trb) * DWC3_TRB_NUM); /* Link TRB. The HWO bit is never reset */ trb_st_hw = &dep->trb_pool[0]; trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; - memset(trb_link, 0, sizeof(*trb_link)); + memset_io(trb_link, 0, sizeof(*trb_link)); trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); @@ -2908,10 +2908,10 @@ static void dwc3_gadget_poll(struct usb_gadget * g) buf = xzalloc(count); amount = min(count, evt->length - evt->lpos); - memcpy(buf, evt->buf + evt->lpos, amount); + memcpy_fromio(buf, evt->buf + evt->lpos, amount); if (amount < count) - memcpy(buf + amount, evt->buf, count - amount); + memcpy_fromio(buf + amount, evt->buf, count - amount); evt->lpos = (evt->lpos + count) % evt->length; -- 2.29.2 _______________________________________________ barebox mailing list barebox@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/barebox
